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DETAILED ACTION 

1 . This Office Action is in response to Applicant's Amendment filed September 28, 
2009. Claims 16-18 and 22-35 are pending in this case. Claims 22, 23, and 24 are 
currently amended. Claims 25-35 are newly added. Claims 22-35 are under 
examination. 

Election/Restrictions 

2. Claims 16-18 are withdrawn from further consideration pursuant to 37 CFR 

1 .142(b), as being drawn to a nonelected invention, there being no allowable generic or 
linking claim. Applicant timely traversed the restriction (election) requirement in the reply 
filed on September 28, 2009. Accordingly, claims 22-35 are under examination. 
Response to Arguments 

3. Applicant's arguments filed January 30, 2009 have been fully considered but they 
are not persuasive. 

4. Applicant argues, regarding claim 22, as amended, that nothing in the cited 
references teaches, discloses or suggests "capturing the password provided to the 
source user authenticator, monitoring the source user authenticator for an approval 
response and populating the target datastore with the captured password upon receipt 
of an approval response" 

5. Examiner respectfully disagrees. Since the password is user authentication data, 
Blakley discloses capturing the user authentication data provided by the user in 
response to the source authenticator prompting and using the captured authentication 
data as the received password/authentication data, (col 1 1 In 44-55); monitoring the 
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source user authenticator for an approval response, (col 8 In 1-10, col 9 In 34-67), 
populating the target datastore with the received authentication data upon receipt by the 
target datastore of an approval response from the source user authenticator (col 9 In 
34-67). Sampson discloses a method comprising migrating the source user datastore 
with the source user authenticator to the target datastore with the target user 
authenticator, (e.g. col5 In 55-col 6 In 5, (Registry Server 108 has an Authentication 
Server Module that manages concurrent access of multiple users or browsers 100 to 
Registry Repository; col. 7, lines 30-32 and Computer system 700 ... main memory ... 
dynamic storage device; col. 17, lines 1-15, Registry Repository; col. 6, lines 2-5, col 10 
In 12-60, ), 

6. Note that, in claim 22, the recitations "wherein the source datastore comprises . . 
. source user authenticator", "wherein the interceptor . . identification", constitute 
nonfunctional descriptive data, and thus do not serve to further limit the claim from the 
prior art. In re Gulack, 217 USPQ 401 (Fed. Cir. 1983), In re Ngai, 70 USPQ2d (Fed. 
Cir. 2004), In re Lowry, 32 USPQ2d 1031 (Fed. Cir. 1994); MPEP 2106.01 II. 

Claim Rejections - 35 USC §103 

7. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

8. Claims 22 and 25-35 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Sampson et al (US 6,429,624) in view of Blakley, III et al (US 5,832,21 1 ). 



Application/Control Number: 10/075,336 Page 4 

Art Unit: 3685 

9. Regarding claim 22 - 

10. Sampson discloses a method comprising migrating the source user datastore 
with the source user authenticator to the target datastore with the target user 
authenticator, wherein the target user datastore comprises user identification data, and 
wherein the target user authenticator is in communication with the source user 
authenticator; (e.g. col. 7, lines 30-32; col. 17, lines 1-15, col. 6, lines 2-5) , 

intercepting, by an interceptor, a request to the source user authenticator from a 
user seeking access to information protected by the target user authenticator, (col. 10, 
lines 12-24); 

1 1 . Sampson does not specifically disclose prompting the user for an identification, 
receiving the identification from the user, locating the corresponding identification in the 
target datastore, and determining whether the target datastore includes a password 
associated with the identification; searching the target datastore for the user 
authentication data associated with the identification, wherein upon the determination 
that there is no user authentication data in the target datastore associated with the 
identification; allowing the original intercepted request to go through to the source user 
authenticator, using the source user authenticator to prompt for and receive the 
identification and a password from the user; capturing the user authentication data 
provided by the user in response to the source authenticator prompting and using the 
captured user authentication data as the received user authentication data, monitoring 
the source user authenticator for an approval response, populating the target datastore 
with the received user authentication data upon receipt by the target datastore of an 
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approval response from the source user authenticator, and associating the received 
authentication data with the corresponding identification. 
12. Blakely discloses prompting the user for an identification, receiving the 
identification from the user, locating the corresponding identification in the target 
datastore, and determining whether the target datastore includes a user authentication 
data associated with the identification (col 7 In 17-35); and 

searching the target datastore for the user authentication associated with the 
identification, wherein upon the determination that there is no user authentication data 
in the target datastore associated with the identification: (e.g. col 1 1 In 44-55, col 
1 1 In 25-67) 

allowing the original intercepted request to go through to the source user 
authenticator, (col 1 1 In 25-67) 

using the source user authenticator to prompt for and receive the 
identification and a user authentication data from the user, (col 1 1 In 25-67) 

capturing the authentication data provided by the user in response to the 
source authenticator prompting and using the captured authentication data as the 
received authentication data, col 1 1 In 44-55 

monitoring the source user authenticator for an approval response, (col 8 
In 1-10, col 9 In 34-67) 

populating the target datastore with the received authentication data upon 
receipt by the target datastore of an approval response from the source user 
authenticator, and (col 9 In 34-67) 
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associating the received authentication data with the corresponding 
identification, (col 7 In 17-35). 

1 3. It would be obvious to one of ordinary skill in the art to combine Sampson and 
Blakely since both are in the same field in order to facilitate the use of data during the 
migration phase of the data transfer. 

14. Regarding claim 25 - 

15. Blakley discloses reading unencrypted data from the source datastore, and 
converting the unencrypted data to be compatible with the target datastore; and 
populating the target datastore with the converted data, (col 7 In 30-60). 

16. Note that the recitation "wherein the source . . .authentication data", represents 
nonfunctional descriptive data, and thus does not serve to further limit the claim from 
the prior art. In re Gulack, 217 USPQ 401 (Fed. Cir. 1983), In re Ngai, 70 USPQ2d 
(Fed. Cir. 2004), In re Lowry, 32 USPQ2d 1031 (Fed. Cir. 1994); MPEP 2106.01 II. 

1 7. Regarding claim 26 - 

18. Blakley discloses authenticating the received identification using the target user 
authenticator upon determining that the target datastore includes user authentication 
data associated with the corresponding identification, (col 23 In 5-35), 

1 9. Regarding claim 27 - 

20. Mehring teaches that it is known in the art to provide a receiving a password in a 
submission from the user after the initial submission of the identification from the user, 
further including web page in which the user is prompted to input login data. Col. 10, lines 
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60-67. It would be a predictable result for the webpage to include fields for authentication 
data. KSR International Co. v. Teleflex Inc., 82 USPQ2d 1385 (U.S. 2007) 

21 . Regarding claims 28-35 - 

22. Note that claims 28-35 recite nonfunctional descriptive data, and as such, is not 
further limiting thus not serving to further distinguish the claims from the prior art. In re 
Gulack, 217 USPQ 401 (Fed. Cir. 1983), In re Ngai, 70 USPQ2d (Fed. Cir. 2004), In re 
Lowry, 32 USPQ2d 1031 (Fed. Cir. 1994); MPEP 2106.01 II. 

23. 

24. Claims 23 and 24 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Sampson et al (US 6,429,624) in view of Blakley, III et al (US 5,832,21 1 ) further in 
view of Mehring et al (US 6,609,1 15). 

25. Regarding claim 23: 

26. Blakley discloses the claimed invention except for the receiving a user 
authentication data in a submission from the user after the initial submission of the 
identification from the user. However, Blakley does disclose the use of a user 
authentication/password and a corresponding unique account identification number. Col. 7, 
lines 15-20. Mehring teaches that it is known in the art to provide a receiving a user 
authentication data/password in a submission from the user after the initial submission of 
the identification from the user. Col. 10, lines 60-67. It would have been obvious to one 
having ordinary skill in the art at the time the invention was made to provide the 
password/unique identification element of Blakley with the receiving a user authentication 
data/password in a submission from the user after the initial submission of the identification 
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from the user of Mehring, in order to increase the security in accessing data. Further, It 
would have been obvious to modify the teachings of Blakley, to provide the step of 
receiving a user authentication/password in a submission from the user after the initial 
submission of the identification from the user. 

27. Regarding claim 24 - 

28. Blakley discloses the claimed invention, as discussed above, except for the step of 
prompting for and receiving the identification and a user authentication/password from the 
user after the initial submission of the identification from the user. It would have been an 
obvious to modify the teachings of Blakley to provide the step of prompting for and 
receiving the identification and a user authentication/ password from the user after the initial 
submission of the identification from the user. 

29. Since the applicant has not disclosed that prompting for and receiving the 
identification and a user authentication/password from the user after the initial submission 
of the identification from the user solves any stated problem in a new or unexpected way or 
is for any particular purpose which is unobvious to one of ordinary skill and it appears that 
the claimed feature does not distinguish the invention over similar features in the prior art 
since, the teachings of Blakley will perform the invention as claimed by the applicant with 
any means, method, or product to prompting for and receiving the identification and a 
password from the user after the initial submission of the identification from the user. 

30. It would have been obvious to one having ordinary skill in the art at the time the 
invention was made to provide Sampson with the security method of Blakley with wherein 
the action of prompting for and receiving the identification and a user 
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authentication/password from the user after the initial submission of the identification from 
the user occurs after determining that the target data store does not include a user 
authentication/password associated with the identification; and, wherein the action further 
comprises using the source user authenticator to prompt for and receive the identification 
and a user authentication/password from the user after the initial submission of the 
identification from the user of Mehring, in order to authenticate the user requesting the data. 
Conclusion 

31 . The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

32. Leah et al. US 6,986,038 131 TECHNIQUE FOR SYNCHORNIZING SECURITY 
CREDENTIALS FROM A MASTER DIRECTORY, PLATFORM, OR REGISTRY. Discloses 
prompting of the user. 

33. Lemon US 7,016,953 discloses an HTTP transaction monitor including a servlet that 
intercepts HTTP requests. 

34. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .136(a). 

35. A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
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the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

36. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to CRISTINA SHERR whose telephone number is 

(571 )272-671 1 . The examiner can normally be reached on 8:30-5:00 Monday through 
Friday. 

37. If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Calvin L. Hewitt, II can be reached on (571)272-6709. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 
273-8300. 

38. Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

CRISTINA OWEN SHERR 

Examiner 

Art Unit 3685 

/Calvin L Hewitt II/ 
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